Manufacturers of automated teller machines (ATMs) market their equipment typically in two market segments: financial markets and retail markets. The ATMs that are installed in the financial markets are targeted at larger and higher volume financial institutions, and the ATMs installed in the retail markets are targeted at lower volume and more plentiful retail market locations. The retail market entails most all locations that can use an ATM that are not part of banks or financial institutions. The retail market has much lower transaction volume on average than the financial market so a lower cost enhanced security solution is needed in the retail market than in the financial market.
Retail market ATMs tend to be less expensive to buy, transport, and install than financial market ATMs, and one reason is that retail market ATMs tend to use lighter weight and less secure vaults than their financial market counterparts. A typical retail market ATM might weigh approximately 225 lbs., while it is not uncommon to find financial market ATMs weighing approximately 1200 lbs. In addition to retail market ATM purchase price being much lower than financial market ATM purchase price, with their lighter weight, they take much less manpower to move and install, leading to a lower cost to transport and install than financial market ATMs. A typical retail market ATM is typically able to be moved and installed by one person, whereas financial market ATMs commonly require more than one person to move or install, due to the additional weight. This adds to the cost to move and install financial market ATMs as compared to retail market ATMs. Because of their lower total investment, retail market ATMs require much less transaction volume to become profitable and financially sustainable than their financial market counterparts, which is why financial market ATMs are not typically used in the retail market segment. With their cheaper and less secure vaults and more plentiful locations, retail market ATMs are often prime targets for theft.
There are many more lower volume ATM locations than higher volume ATM locations, which is why retail market ATMs make up the majority of all ATM installations. It would not be possible to use the more expensive and more secure financial market ATMs in the retail market segment, since the transaction volume in the retail segment would not be sufficient to sustain the ATM investments in these lower volume locations. The transaction volume in the retail segment is only enough to financially sustain financially the lower cost retail ATMs. Substituting financial ATMs that have better, higher rated, and more secure vaults in the retail market is not a feasible solution to increasing the security of retail market ATM vaults.
There are various rating systems for vaults that measure a degree of difficulty in breaching the vault. One rating system is put out by Underwriters Laboratories (UL) and is commonly used to rate ATM vault security. A typical financial ATM might have a minimum rating of “UL 291” “level 1” safe and other more expensive models might have higher or different ratings than UL291 level 1, including RAL TL-30 derivatives, and CEN EN 1143-1-CEN III and CEN IV. It is typical for retail market ATMs to have a UL291 “business hour” rating only, a step lower than a “level 1” rating. With a business hour rating, it is recommended to only leave cash in the vault during normal business hours. However, even with such a rating, it is only feasible for very few ATM operators to remove the cash at all times when the business is closed. This leads to a situation where most ATMs with only UL 291 business hour rating stay stocked with cash at all times, even during the times the locations are physically closed and not open for business. This in turn leads to the problem in large numbers of retail ATMs being the cash in the ATM vault only protected by business hour rated safes after hours.
Most ATMs are connected to interbank networks, enabling people to withdraw and deposit money from machines not belonging to the bank where they have their accounts or in the countries where their accounts are held (enabling cash withdrawals in local currency). ATMs rely on authorization of a financial transaction by a card issuer or other authorizing institution on a communications network. Many banks charge ATM usage fees. In some cases, these fees are charged solely to users who are not customers of the bank where the ATM is installed; in other cases, they apply to all users. ATMs are placed not only near or inside the premises of banks, but also in locations such as shopping centers/malls, airports, grocery stores, convenience stores, petrol/gas stations, restaurants, or anywhere frequented by large numbers of people.
There are two types of ATM installations: on- and off-premises. On-premises ATMs are typically more advanced, multi-function machines that complement a bank branch's capabilities, and are thus more expensive (financial market ATMs). Off-premises machines are deployed by financial institutions and independent sellers (Retail market ATMs). ATMs can also be found in railway stations and train stations, and bus terminals.
An ATM is typically made up of the following devices: a CPU to control the user interface and transaction devices, a magnetic or chip card reader to identify customers, a PIN pad, a secure crypto-processor, generally within a secure enclosure, a display for customers to perform transactions, function key buttons or a touchscreen to select options for the transaction, a record printer to provide customers with transaction records, a vault to store the parts of the machinery requiring restricted access, including cash, a housing for aesthetics and to attach signage to, and various sensors and indicators.
Mechanisms found inside the vault may include: a dispensing mechanism to provide cash to customers, a deposit mechanism including a check processing module and bulk note acceptor to allow customers to make deposits, various security sensors, locks to ensure controlled access to the contents of the vault, and journaling systems.
Early ATM security focused on making the terminals invulnerable to physical attack; they were effectively safes with dispenser mechanisms. A number of attacks resulted, with thieves attempting to steal entire machines by ram-raiding or “smash and grab” attacks. Since the late 1990s, criminal groups improved ram-raiding by using a truck loaded with heavy items to effectively demolish or uproot an entire ATM and any housing in order to steal its cash.
Another attack method is to seal all openings of the ATM with silicone and fill the vault with a combustible gas or to place an explosive inside, attached, or near the machine. This gas or explosive is ignited and the vault is opened or distorted by the force of the resulting explosion and the thieves can then break in. These types of attacks can be prevented by a number of gas explosion prevention devices also known as gas suppression systems. These systems use explosive gas detection sensor to detect explosive gas and to neutralize it by releasing a special explosion suppression chemical which changes the composition of the explosive gas and thereby renders it ineffective.